@intentius/chant 0.124.28 → 0.124.30

package/src/workspace/reference-kinds/flag/flag.schema.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "urn:intentius:chant:flag:1",
+  "title": "Feature flag front matter",
+  "description": "The front matter of one feature flag record (#4024): a workspace record one member's build reads as a build-time parameter. The file is named <id>.flag.md.",
+  "type": "object",
+  "additionalProperties": false,
+  "patternProperties": {
+    "^x-": {}
+  },
+  "required": ["schema", "id", "owner", "work", "member", "param", "values"],
+  "properties": {
+    "schema": {
+      "description": "Format version of this file. Bumped only by a change to this schema.",
+      "const": 1
+    },
+    "id": {
+      "description": "The flag's name, which the build records as the source flag:<id> of the parameter it sets. Lowercase, with dashes.",
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]{0,62}$"
+    },
+    "title": {
+      "description": "What the flag hides, in a few words. Optional.",
+      "type": "string"
+    },
+    "owner": {
+      "description": "Who owns the flag, and removes it once its work is settled.",
+      "type": "string",
+      "minLength": 1
+    },
+    "work": {
+      "description": "The id of the work item the flag hides, a record of the work kind the flag kind names. A work item's implements names a decision, never a flag, so the link is kept here.",
+      "type": "string",
+      "minLength": 1
+    },
+    "member": {
+      "description": "The workspace member whose build parameter the flag sets, by its name in chant.workspace.json.",
+      "type": "string",
+      "minLength": 1
+    },
+    "param": {
+      "description": "The build parameter the flag sets: a key of buildParams in the member's chant.config.ts. Its value per environment must have the parameter's type and, when it declares one, be in its enum.",
+      "type": "string",
+      "minLength": 1
+    },
+    "values": {
+      "description": "The flag's value per environment, keyed by the environment's name. An environment left out builds with the parameter's declared default.",
+      "type": "object",
+      "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+      "additionalProperties": { "type": ["string", "number", "boolean"] }
+    }
+  }
+}

package/src/workspace/releases.schema.json

@@ -177,6 +177,17 @@
               }
             }
           }
+        },
+        "revoked": {
+          "description": "Added within contract version 1 by #4033, written by chant 0.124.29 and newer. The ci/revoked/<sha> tag on the release's commit, or null when the commit is not revoked. A revoked release is never promoted (chant components promote --release refuses it) and its pending release gates refuse approval. Null too when the ci tags can't be judged, as when ci.green.signedSince names no commit here, which chant workspace check reports.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/revocation"
+            }
+          ]
         }
       }
     },
@@ -280,6 +291,13 @@
           "type": "string",
           "description": "ISO 8601."
         },
+        "runId": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Added by #4027, written by chant 0.124.29 and newer. The run the cut ran in: the CI run's id in CI (GITHUB_RUN_ID, CI_PIPELINE_ID), or outside CI an id minted on the machine that cut, local-<epoch ms>. Null on a cut written before 0.124.29."
+        },
         "runOrigin": {
           "oneOf": [
             {
@@ -308,7 +326,7 @@
               }
             }
           ],
-          "description": "The CI run the cut ran in: the forge (github for GitHub and Forgejo, gitlab), the repo or project, and a link to the run. Null outside CI."
+          "description": "The run the cut ran in: the forge (github for GitHub and Forgejo, gitlab, or local for an id minted outside CI), the repo or project, and a link to the run. From chant 0.124.29 a cut outside CI writes { forge: local } (#4027); a cut written before reads null outside CI."
         },
         "signature": {
           "type": [
@@ -386,6 +404,110 @@
           }
         }
       }
+    },
+    "revocation": {
+      "type": "object",
+      "description": "A revoked tag on a release's commit (#4033, ws-105), as chant ci list --json shows a commit's revoked tag, with the commit. Read from local tags at read time and judged as release cut judges them: with ci.green.signedSince, a revoked tag without a valid runner statement is ignored and revokes nothing.",
+      "required": [
+        "commit",
+        "tag",
+        "tagged",
+        "phase",
+        "run",
+        "signer"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string",
+          "description": "The release's commit, which the tag names."
+        },
+        "tag": {
+          "type": "string",
+          "description": "ci/revoked/<sha>."
+        },
+        "tagged": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "When the tag was made, ISO 8601, or null for a lightweight tag."
+        },
+        "phase": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The phase the annotation names as failed, or null when the annotation can't be read."
+        },
+        "run": {
+          "description": "The run the annotation names as failed, or null.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": [
+                "name",
+                "id",
+                "conclusion",
+                "url"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "id": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ],
+                  "description": "The check run's id, or null for a chant Op run."
+                },
+                "conclusion": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "url": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "opRun": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "env",
+                    "signer"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    },
+                    "env": {
+                      "type": "string"
+                    },
+                    "signer": {
+                      "type": "string"
+                    }
+                  },
+                  "description": "Present only when the run is a chant Op run (ci.green.source runs, #4044): its id, the env it is recorded under and the runner whose statement it carries. id above is then null."
+                }
+              }
+            }
+          ]
+        },
+        "signer": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The runner principal whose statement the tag carries, or null when it counts unsigned."
+        }
+      }
     }
   }
 }

package/src/workspace/releases.ts

@@ -8,6 +8,12 @@
  * `releaseDigest`. A promote under a release writes that field; deploys made
  * any other way do not name a release yet (#4043), so they list nowhere.
  *
+ * Each release carries `revoked` (#4033, ws-105): the `ci/revoked/<sha>` tag
+ * on its commit, judged as `release cut` judges it, or null. It is read from
+ * local tags at read time; nothing records it. When the tags can't be judged
+ * (a `ci.green.signedSince` naming no commit here) every release reads null,
+ * and `chant workspace check` reports the declaration.
+ *
  * Each cut carries `signatureCheck` (#4031): whether its signature verifies
  * for its actor against the signers at base, and, when the declaration names
  * a `release` gate with a class, whether the actor is in it.
@@ -24,6 +30,7 @@ import { readAllReleases, readCuts, type Release, type ReleaseCut } from "../lif
 import { resolveMemberLedger } from "../lifecycle/member-ledger";
 import { readerVersion } from "./declaration";
 import { checkReleaseSignature, type GateAdmissionRule, type ReleaseSignatureCheck } from "./identity-gate-rule";
+import { readRevokedCommits, revocationOf, type ReleaseRevocation } from "../lifecycle/release-revocation";
 
 export const RELEASES_CONTRACT_VERSION = 1;
 export const RELEASES_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/releases/v1/releases.schema.json";
@@ -41,6 +48,8 @@ export interface ReleaseEntry extends Omit<Release, "version"> {
   cuts: Array<Omit<ReleaseCut, "version" | "releaseDigest"> & { signatureCheck: ReleaseSignatureCheck }>;
   /** The environments that run it, and in each the components whose latest deploy names it. Sorted by env. */
   environments: Array<{ env: string; components: string[] }>;
+  /** The revoked tag on its commit (#4033), or null when the commit is not revoked. */
+  revoked: ReleaseRevocation | null;
 }
 
 export type ReleasesDocument =
@@ -93,6 +102,7 @@ export async function releasesDocument(req: { cwd: string }): Promise<ReleasesDo
     }
 
     const rule = await releaseRule(req.cwd);
+    const revoked = await readRevokedCommits(req.cwd).catch(() => new Map<string, ReleaseRevocation>());
     const entries: ReleaseEntry[] = releases.map(({ version: _v, ...release }) => {
       const own = cuts.filter((c) => c.releaseDigest === release.releaseDigest);
       return {
@@ -102,6 +112,7 @@ export async function releasesDocument(req: { cwd: string }): Promise<ReleasesDo
         environments: [...(running.get(release.releaseDigest) ?? new Map<string, string[]>())]
           .map(([env, components]) => ({ env, components }))
           .sort((a, b) => (a.env < b.env ? -1 : 1)),
+        revoked: revocationOf(release, revoked),
       };
     });
     const latest = (e: ReleaseEntry): string => e.cuts.map((c) => c.timestamp).sort().at(-1) ?? "";

package/src/workspace/run-event.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://intentius.io/chant/schemas/workspace/run-event/v1/run-event.schema.json",
   "title": "chant run event",
-  "description": "One event of a run's stream (#4019, behold #678): one JSON object per line, written by writeRunEvent and createRunEventWriter in src/run-event.ts. It covers Op runs, component runs and pipeline runs alike. Every event names the run, what it ran, the commit it built from and the runtime it ran on, so a reader shows a run the same way wherever it happened. A run's stream opens with run-start and ends with run-settle, whose status is the run's verdict; seq counts the events from 0. Version 1 of the read contract. Readers ignore fields they do not know; a field is only ever added within a version. The status sets are closed. Contract version 1 of this document is written by chant 0.124.28 and newer; the read contract as a whole by chant 0.81.0 and newer.",
+  "description": "One event of a run's stream (#4019, behold #678): one JSON object per line, written by writeRunEvent and createRunEventWriter in src/run-event.ts. It covers Op runs, component runs and pipeline runs alike. Every event names the run, what it ran, the commit it built from and the runtime it ran on, so a reader shows a run the same way wherever it happened. A run's stream opens with run-start and ends with run-settle, whose status is the run's verdict; seq counts the events from 0. Version 1 of the read contract. Readers ignore fields they do not know; a field is only ever added within a version. A status set gains a value only as an addition within a version, which the read contract lists with the chant that first writes it; a reader treats a status it does not know as a settle it cannot classify and reads on. Contract version 1 of this document is written by chant 0.124.28 and newer; the read contract as a whole by chant 0.81.0 and newer.",
   "oneOf": [
     { "$ref": "#/$defs/run-start" },
     { "$ref": "#/$defs/run-settle" },
@@ -50,8 +50,8 @@
       "required": ["forge"],
       "properties": {
         "forge": {
-          "enum": ["github", "gitlab", "op", "local"],
-          "description": "github: a GitHub Actions run, also the spelling Forgejo Actions uses. gitlab: a CI pipeline. op: a steward's run, named by its Op run id. local: a run on the machine that started it, outside CI."
+          "enum": ["github", "gitlab", "op", "local", "chant"],
+          "description": "github: a GitHub Actions run, also the spelling Forgejo Actions uses. gitlab: a CI pipeline. op: a steward's run, named by its Op run id. local: a run on the machine that started it, outside CI. chant: a pull-request job the chant runner ran (chant ci run, #4094), named by its Op run id; added within contract version 1 and written by chant 0.124.30 and newer, so a reader that switches on forge keeps a case for a value it does not know."
         },
         "repo": { "type": "string", "description": "The repository or project slug on the forge, when the environment named one." },
         "url": { "type": "string", "description": "A link to the run, when the environment gave enough to build one." }
@@ -95,7 +95,18 @@
             "type": { "const": "run-settle" },
             "status": { "$ref": "#/$defs/settleStatus" },
             "durationMs": { "type": ["integer", "null"], "minimum": 0, "description": "From run-start to now, or null when the writer did not time it." },
-            "error": { "type": "string", "description": "With status failed, what failed, when the writer knows." }
+            "error": { "type": "string", "description": "With status failed, what failed, when the writer knows." },
+            "failure": {
+              "type": "object",
+              "required": ["code", "reason"],
+              "description": "Added within contract version 1 by #4094, written by chant 0.124.30 and newer. With status failed: why, as the run record's failure says. code is a pull-request report's refusal or status (not-approved, plan-changed, not-a-reviewer, no-pull-request, plan-failed, failed, refused) or command-failed, setup-failed or build-failed, and a reader keeps a case for a code it does not know. reason is one line for a person, phase the phase that failed, exitCode the failed command's exit code. chant ci run writes it on every failed job.",
+              "properties": {
+                "code": { "type": "string", "minLength": 1 },
+                "reason": { "type": "string" },
+                "phase": { "type": "string" },
+                "exitCode": { "type": "integer" }
+              }
+            }
           }
         }
       ]
@@ -150,13 +161,20 @@
         { "$ref": "#/$defs/envelope" },
         {
           "type": "object",
-          "description": "A component's composition settled, after any rollback the run did for it.",
+          "description": "A component's composition settled, after any rollback the run did for it. A component the run did not start settles too, with no component-start before it: blocked when a dependency failed or stopped at a gate, already-applied when an earlier attempt the run resumed applied it.",
           "required": ["type", "wave", "component", "status"],
           "properties": {
             "type": { "const": "component-settle" },
             "wave": { "type": "integer", "minimum": 1 },
             "component": { "type": "string" },
-            "status": { "$ref": "#/$defs/settleStatus" }
+            "status": {
+              "enum": ["ok", "failed", "gated", "waiting", "blocked", "already-applied"],
+              "description": "The settle statuses of a run, wave or phase, and two more for a component the run did not start, added within contract version 1 by #4007 and written by chant 0.124.29 and newer. blocked: a dependency failed or stopped at a gate, so it never ran; blockedBy names the dependency. already-applied: an earlier attempt the run resumed applied it, so it did not run again; its wave is the wave it had in that attempt's derivation. A reader that knows only the four settle statuses can read either as a component that did not run in this run."
+            },
+            "blockedBy": {
+              "type": "string",
+              "description": "With blocked: the failed or gated component the run reached this one from. Added within contract version 1 by #4007, written by chant 0.124.29 and newer."
+            }
           }
         }
       ]

package/src/workspace/status-contract.test.ts

@@ -478,6 +478,35 @@ describe("commit, run and gate on the records status --json lists (#4020)", () =
   });
 });
 
+describe("the release a deploy was made from, on the records status --json lists (#4043)", () => {
+  test("a release item carries the releaseDigest and the label it was cut with, and null when there is none", async () => {
+    const root = twoLayouts();
+    const rd = `jcs1-sha256:${"e".repeat(64)}`;
+    const cut = JSON.stringify({ version: 1, releaseDigest: rd, label: "v1.2.0", actor: "alice", timestamp: "2026-09-19T00:00:00.000Z", runOrigin: null, signature: null });
+    lifecycle(root, {
+      "_members/web/staging/releases.jsonl": jsonl(release("web", "staging", D("a"), "a".repeat(40), { releaseDigest: rd })),
+      "_members/web/_releases/cuts.jsonl": `${cut}\n`,
+      "staging/releases.jsonl": jsonl(release("api", "staging", D("b"), "b".repeat(40))),
+    });
+    const doc = result(await workspaceStatus({ cwd: root, env: "staging", now: NOW }));
+    expectValid(doc);
+    const [, web, api] = doc.members;
+    expect(web.environments[0].releases[0]).toMatchObject({ releaseDigest: rd, releaseLabel: "v1.2.0" });
+    expect(api.environments[0].releases[0]).toMatchObject({ releaseDigest: null, releaseLabel: null });
+  });
+
+  test("a release with no cut line keeps its digest and has no label", async () => {
+    const root = twoLayouts();
+    const rd = `jcs1-sha256:${"e".repeat(64)}`;
+    lifecycle(root, {
+      "_members/web/staging/releases.jsonl": jsonl(release("web", "staging", D("a"), "a".repeat(40), { releaseDigest: rd })),
+    });
+    const doc = result(await workspaceStatus({ cwd: root, env: "staging", now: NOW }));
+    expectValid(doc);
+    expect(doc.members[1].environments[0].releases[0]).toMatchObject({ releaseDigest: rd, releaseLabel: null });
+  });
+});
+
 describe("gate state in chant workspace status --json (#2674)", () => {
   test("each member lists its gates with state, approvals, quorum and the approve line", async () => {
     const doc = result(await workspaceStatus({ cwd: gated(), env: "staging", compareTo: "prod", now: NOW }));

package/src/workspace/status-gates.ts

@@ -25,6 +25,7 @@ import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, parseGateLedger } from "../lifecycle/gate-ledger";
 import { humanQuorumSince, tallyGateApprovals, type GateApprovalRule } from "../op/gate";
 import type { ReasonCode } from "./reason-codes";
+import type { ReleaseRevocation } from "../lifecycle/release-revocation";
 import { CHANGE_SETS_DIR, changeSetFile } from "../lifecycle/change-set-store";
 
 /** The stored change-set directory beside a gate ledger directory: `<prefix>_change-sets`. */
@@ -73,6 +74,13 @@ export interface StatusGate {
    */
   releaseDigest?: string;
   state: GateState;
+  /**
+   * Set on a release gate whose release was cut from a revoked commit
+   * (#4033, ws-105): the revoked tag on that commit. The gate is then
+   * `superseded` (or `expired`), and `chant approve` refuses it with
+   * `release-revoked`. Added by `workspace status`; absent otherwise.
+   */
+  revoked?: ReleaseRevocation;
   /** When the run recorded the pending fact the state is read against. */
   recordedAt: string;
   /** The commit the run reached the gate at (#4020), from the pending fact. Absent on a fact written before chant 0.124.28. */

package/src/workspace/status-mixed.test.ts

@@ -0,0 +1,152 @@
+/**
+ * #4035: an environment a promote left mixed, as `workspace status --json`
+ * shows it: what each component runs, and the redeploy and rollback lines
+ * that settle it. Against temp repos; nothing is pushed.
+ */
+
+import { describe, expect, test } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Ajv2020 } from "ajv/dist/2020";
+import statusSchema from "./status.schema.json";
+import { formatStatus, workspaceStatus, type StatusDocument } from "./status";
+import { appendCut, makeRelease, persistRelease, type Release } from "../lifecycle/release-store";
+import { appendReleaseRecord, type ReleaseRecordInput } from "../lifecycle/release-ledger";
+import { appendDeployOutcome } from "../lifecycle/deploy-outcome";
+import { contentDigest } from "../content-digest";
+
+const validateStatus = new Ajv2020({ strict: true, allErrors: true }).compile(statusSchema);
+const NOW = "2026-10-17T14:00:00.000Z";
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+function result(doc: StatusDocument): Extract<StatusDocument, { members: unknown }> {
+  if ("error" in doc) throw new Error(`${doc.error.code}: ${doc.error.message}`);
+  expect(validateStatus(doc), JSON.stringify(validateStatus.errors, null, 2)).toBe(true);
+  return doc;
+}
+
+/** A workspace whose root member has releases v1.0.0 and v1.1.0 of api and web, and runs v1.0.0 in prod. */
+async function setup(dir: string): Promise<{ v1: Release; v2: Release; deploy: (input: Partial<ReleaseRecordInput> & { component: string; timestamp: string; releaseDigest: string }) => Promise<void> }> {
+  git(dir, "init", "-q", "-b", "main");
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  writeFileSync(
+    join(dir, "chant.workspace.json"),
+    JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the fixture" }] }, null, 2),
+  );
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  const first = git(dir, "rev-parse", "HEAD");
+  git(dir, "commit", "-q", "--allow-empty", "-m", "next");
+  const second = git(dir, "rev-parse", "HEAD");
+  const at = (commit: string) =>
+    makeRelease({
+      member: null,
+      commit,
+      artifactDigests: ["api", "web"].map((component) => ({ component, kind: "image" as const, path: `${component}.tar`, digest: contentDigest(`${component} ${commit}`) })),
+      targets: [{ env: "prod", templates: [], params: [] }],
+    });
+  const v1 = at(first);
+  const v2 = at(second);
+  for (const [r, label, ts] of [[v1, "v1.0.0", "10"], [v2, "v1.1.0", "11"]] as const) {
+    await persistRelease(r, [], { cwd: dir });
+    await appendCut({ releaseDigest: r.releaseDigest, label, actor: "alice", timestamp: `2026-10-17T${ts}:00:00.000Z`, runOrigin: null }, { cwd: dir });
+  }
+  const deploy = async (input: Partial<ReleaseRecordInput> & { component: string; timestamp: string; releaseDigest: string }) => {
+    await appendReleaseRecord(
+      { env: "prod", digest: contentDigest(`${input.component} ${input.releaseDigest}`), gitSha: first, runId: "r", actor: "ci", ...input },
+      { cwd: dir },
+    );
+  };
+  for (const component of ["api", "web"]) await deploy({ component, timestamp: "2026-10-17T12:00:00.000Z", releaseDigest: v1.releaseDigest });
+  return { v1, v2, deploy };
+}
+
+describe("a mixed environment in workspace status (#4035)", () => {
+  test("a partly applied promote shows the environment mixed, with the redeploy and rollback lines, until it is settled", async () => {
+    await withTestDir(async (dir) => {
+      const { v1, v2, deploy } = await setup(dir);
+
+      // Before the promote: one release, nothing mixed.
+      const before = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW }));
+      expect(before.members[0].environments[0]).not.toHaveProperty("mixed");
+
+      // The promote of v1.1.0 deploys api and fails on web.
+      const at = "2026-10-17T13:00:00.000Z";
+      await deploy({ component: "api", timestamp: at, releaseDigest: v2.releaseDigest, runId: "run-9", promotedFrom: { env: "staging", runId: "run-8", timestamp: "2026-10-17T12:30:00.000Z" } });
+      await appendDeployOutcome(
+        {
+          version: 1, env: "prod", verb: "promote", runId: "run-9", timestamp: at, actor: "bob", releaseDigest: v2.releaseDigest, status: "fail",
+          components: [
+            { component: "api", outcome: "deployed", digest: contentDigest(`api ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest },
+            { component: "web", outcome: "failed", digest: contentDigest(`web ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest },
+          ],
+        },
+        { cwd: dir },
+      );
+
+      const doc = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW }));
+      const prod = doc.members[0].environments[0];
+      expect(prod.mixed).toEqual({
+        components: [
+          { component: "api", digest: contentDigest(`api ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest, releaseLabel: "v1.1.0", state: "settled", attempt: null },
+          {
+            component: "web",
+            digest: contentDigest(`web ${v1.releaseDigest}`),
+            releaseDigest: v1.releaseDigest,
+            releaseLabel: "v1.0.0",
+            state: "failed",
+            attempt: { verb: "promote", runId: "run-9", timestamp: at, digest: contentDigest(`web ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest, releaseLabel: "v1.1.0" },
+          },
+        ],
+        redeploy: ["chant components redeploy prod --component web"],
+        rollback: "chant components rollback prod --release v1.0.0",
+      });
+      expect(formatStatus(doc)).toContain("  prod is mixed: api runs release v1.1.0; web failed (promote run-9), recorded release v1.0.0");
+      expect(formatStatus(doc)).toContain("    redeploy: chant components redeploy prod --component web");
+      expect(formatStatus(doc)).toContain("    roll back: chant components rollback prod --release v1.0.0");
+
+      // A redeploy of web settles it, but prod still runs two releases.
+      await deploy({ component: "web", timestamp: "2026-10-17T13:10:00.000Z", releaseDigest: v1.releaseDigest, redeploys: { env: "prod", runId: "r", timestamp: "2026-10-17T12:00:00.000Z" } });
+      const redeployed = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW })).members[0].environments[0];
+      expect(redeployed.mixed).toMatchObject({
+        components: [{ component: "api", state: "settled", releaseLabel: "v1.1.0" }, { component: "web", state: "settled", releaseLabel: "v1.0.0" }],
+        redeploy: [],
+        rollback: "chant components rollback prod --release v1.0.0",
+      });
+
+      // The same promote run again puts web on v1.1.0: one release, nothing mixed.
+      await deploy({ component: "web", timestamp: "2026-10-17T13:20:00.000Z", releaseDigest: v2.releaseDigest });
+      const settled = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW })).members[0].environments[0];
+      expect(settled).not.toHaveProperty("mixed");
+    });
+  });
+
+  test("a revoked release's rollback line names the release the environment ran before it", async () => {
+    await withTestDir(async (dir) => {
+      const { v2, deploy } = await setup(dir);
+      for (const component of ["api", "web"]) await deploy({ component, timestamp: "2026-10-17T13:00:00.000Z", releaseDigest: v2.releaseDigest });
+      writeFileSync(
+        join(dir, "chant.workspace.json"),
+        JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the fixture" }], ci: { green: { branch: "main", phases: { test: ["test"] }, require: ["test"] } } }, null, 2),
+      );
+      git(dir, "commit", "-q", "-am", "ci.green");
+      const record = { schema: 1, tag: "revoked", commit: v2.commit, branch: "main", at: "2026-10-17T13:30:00.000Z", phase: "test", run: { name: "test", id: 77, conclusion: "failure", url: null } };
+      git(dir, "tag", "-a", "-m", `ci: phase test failed\n\n${JSON.stringify(record, null, 2)}\n`, `ci/revoked/${v2.commit}`, v2.commit);
+
+      const prod = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW })).members[0].environments[0];
+      expect(prod.releases.map((r) => [r.component, r.revoked?.rollback])).toEqual([
+        ["api", "chant components rollback prod --release v1.0.0"],
+        ["web", "chant components rollback prod --release v1.0.0"],
+      ]);
+      expect(prod).not.toHaveProperty("mixed");
+    });
+  });
+});